valca vehicle & life cover agency ltd - mpn

Valca Vehicle & Life Cover Agency Ltd - MPNMONETARY PENAL TY NOTICE
1. The Information Commissioner ("Commissioner") has decided to issue
Valca Vehicle and Life Cover Agency Limited ("Valca") with a monetary
penalty under section SSA of the Data Protection Act 1998 ("DPA"). The
penalty is in relation to a serious contravention of Regulations 22 and
23 of the Privacy and Electronic Communications (EC Directive)
Regulations 2003 ("PECR").
Legal framework
3. Valca, whose registered office is given above (Companies House
Registration Number: 11013461) is the organisation stated in this
notice to have transmitted unsolicited communications by means of
electronic mail to individual subscribers for the purposes of direct
marketing contrary to regulation 22 of PECR.
4. Regulation 22 of PECR states:
1
communications by means of electronic mail to individual
subscribers.
(2) Except in the circumstances referred to in paragraph (3), a person
shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of
electronic mail unless the recipient of the electronic mail has
previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the
sender.
(3) A person may send or instigate the sending of electronic mail for
the purposes of direct marketing where-
(a) that person has obtained the contact details of the recipient
of that electronic mail in the course of the sale or
negotiations for the sale of a product or service to that recipient;
(b) the direct marketing is in respect of that person's similar
products and services only; and
( c) the recipient has been given a simple means of refusing
(free of charge except for the costs of the transmission of
the refusal) the use of his contact details for the purposes
of such direct marketing, at the time that the details were
initially collected, and, where he did not initially refuse the
use of the details, at the time of each subsequent
communication.
( 4) A subscriber shall not permit his line to be used in contravention of paragraph (2)."
2
ICO. Information Commissioner's Office
5. Regulation 23 of PECR states that "A person shall neither transmit, nor
instigate the transmission of, a communication for the purposes of
direct marketing by means of electronic mail -
(a) where the identity of the person on whose behalf the
communication has been sent has been disguised or
concealed;
(b) where a valid address to which the recipient of the
communication may send a request that such
communications cease has not been provided
(c) where that electronic mail would contravene regulation 7 of
the Electronic Commerce (EC Directive) Regulations 2002;
or
websites which contravene that regulation."
6. Section 122(5) of the DPA 2018 defines direct marketing as "the
communication (by whatever means) of advertising material which is
directed to particular individuals". This definition also applies for the
purposes of PECR (see regulation 2(2) PECR; and Schedule 19, paragraph 430 and 432(6) DPA18).
7. Consent is defined in Article 4(11) the General Data Protection
Regulation 2016/679 as "any freely given, specific, informed and
unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies
agreement to the processing of personal data relating to him or her.
8. "Individual" is defined in regulation 2(1) of PECR as "a living individual
and includes an unincorporated body of such individuals".
3
9. A "subscriber" is defined in regulation 2(1) of PECR as "a person who is
a party to a contract with a provider of public electronic
communications services for the supply of such services".
10. "Electronic mail" is defined in regulation 2(1) of PECR as "any text,
voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the
recipient's terminal equipment until it is collected by the recipient and
includes messages sent using a short message service".
11. Section SSA of the DPA (as amended by the Privacy and Electronic
Communications (EC Directive)(Amendment) Regulations 2011 and the
Privacy and Electronic Communications (Amendment) Regulations 2015) states:
"(1) The Commissioner may serve a person with a monetary penalty if
the Commissioner is satisfied that -
(a) there has been a serious contravention of the requirements
of the Privacy and Electronic Communications (EC
Directive) Regulations 2003 by the person,
(b) subsection (2) or (3) applies.
(2) This subsection applies if the contravention was deliberate.
(3) This subsection applies if the person -
(a) knew or ought to have known that there was a risk that
the contravention would occur, but
(b) failed to take reasonable steps to prevent the contravention."
4
12. The Commissioner has issued statutory guidance under section SSC (1) of the DPA about the issuing of monetary penalties that has been
published on the ICO's website. The Data Protection (Monetary
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe
that the amount of any penalty determined by the Commissioner must not exceed £500,000.
13. PECR implements European legislation (Directive 2002/58/EC) aimed at
the protection of the individual's fundamental right to privacy in the
electronic communications sector. PECR was amended for the purpose
of giving effect to Directive 2009/136/EC which amended and
strengthened the 2002 provisions. The Commissioner approaches PECR so as to give effect to the Directives.
14. The provisions of the DPA remain in force for the purposes of PECR
notwithstanding the introduction of the Data Protection Act 2018 (see
paragraph 58(1) of Part 9, Schedule 20 of that Act).
Background to the case
15. Phone users can report the receipt of unsolicited marketing text messages to the GSMA's Spam Reporting Service by forwarding the
message to 7726 (spelling out "SPAM"). The GSMA is an organisation
that represents the interests of mobile operators worldwide. The Commissioner is provided with access to the data on complaints made to the 7726 service and this data is incorporated into a Monthly Threat
Assessment (MTA) used to ascertain organisations in breach of PECR.
16. Valca are a company specialising in lead generation for financial products. They currently operate as 'Debtquity' to generate leads for
5
products.
17. Val ca came to the attention of the Commissioner after an initial 22
complaints were received via the 7726 complaints tool about
unsolicited text messages between 15 June 2020 and 23 June 2020. These text messages contained, or contained slight variations of, the
following text:
"*firstname* Affected by Covid? Struggling with finances? lost job
/furloughed? Were here to help! Gvnmnt backed support see if you
qualify http ://www.debtquity.org"
18. It was noted that these texts did not offer individuals an ability to 'opt
out' of future unsolicited text messages.
19. An initial investigation letter was sent to Valca on 24 June 2020,
highlighting the Commissioner's concerns with Valca's PECR compliance and requesting information relating to the volumes of texts sent, the
source of data used to send said texts, details of any due diligence
undertaken, together with questions regarding the lack of an opt-out in
the text messages for which there had been complaints. An appendix
detailing the complaints received was also sent to Valca.
20. The director of Valca provided a partial response on 24 June 2020 stating that "all data we use is fully compliant and purchased from credible UK data suppliers that we carried out full due diligence against
prior to point of supply, in relation to not listing an opt out on said SMS
messages this is down to human error and has been amended now for
future broadcasts, we are happy to send out an opt out message to the complaints made to date which is a total of 23 from a one of broadcast
of 30. 000 lines of opted in data. We only commenced the sms
the bud campaign on the 15th June 2020 so we have nipped this in
extremely early" [sic].
21. The Commissioner, on 25 June 2020, advised Valca not to contact the
complainants again, but to add them to a suppression list, and asked that Valca respond to all of the initial questions asked by the Commissioner in full.
22. A further substantive response was provided by Valca on 7 July 2020.
This response advised that two platforms were used to send Valca's direct marketing messages: _, and_, with reports being
provided to show the volumes of messages sent via those platforms.
23. Valca confirmed that its data was purchased from a third party: •
Limited (the "third-party data provider"), and that
regarding its due diligence with the third-party data provider, it
"matched our campaign and Company requirements against fully opted
in data, due diligence wise we run various checks on any Company that
we consider using from the ICO MOJ and other governing bodies to ensure that there are no outstanding concerns relating to them as a
potential supplier, we also look at financials, recommendations from
other Companies within this arena and finally check out any online
listings for any bad press".
24. In terms of evidencing how consent is obtained by the third-party data
provider for Valca to engage in direct marketing, Valca advised that it is "on privacy policy and other privacy policies allow for third party
marketing also" [sic].
25. The Commissioner directed further enquiries to Valca on 8 July 2020,
requesting information as to the data purchased, and the agreement
with the third-party data provider. An updated complaints spreadsheet
7
was provided to Valca, showing that there had now been a total of 68
complaints recognised in relation to its text messages.
26. Valca provided a further response on 17 July 2020 stating that it had purchased 100,000 records from the third-party data provider which
were "fully opted in for SMS". Valca was unable to produce a contract as it had been a "trial order" but did produce an invoice between itself
and its third-party data provider dated 16 March 2020 confirming the
purchase of 100,000 leads, and payment for a 'privacy policy edit' to
'. Valca produced updated 'outbound SMS' reports for
its-and - platforms, although it noted that_ had been used for just one day. Valca also produced a document as
purported evidence of consent for the initial 22 complaints, with each
of the 22 complainant's data having been obtained through
27. requires users to register with it to use its services
and operates by offering 'deals'. At the point of registration, users
agree to a consent statement where they are able to select whether
they wish to be contacted by email, SMS, post, and/or telephone,
together with a further option to agree to being contacted by 'the following partners' using the agreed methods. The 'Partners' link takes
users to a 'brands page' which lists 16 distinct companies, none of
which are Valca. There appears to be no option for users to
select/deselect partners.
"Once you register with the our website you consent to
its sponsor question clients and website sponsors being able to send you communications via the channel(s) you selected as part of the sign
8
and its
up until such time as you exercise your right to opt-out of receiving
such communications"
29. The Privacy Policy proceeds to provide two further lists of companies: a
'marketing service providers' list containing 7 distinct companies, and a list of 'direct clients' containing 443 distinct companies. The Privacy
Policy's 'Data Collection Notice' advises that
partners operate in over 40 areas, spanning a wide range of sectors
including fashion, automotive, gambling, construction, legal services etc. The Commissioner noted that Valca were not visible at all as of checks carried out on the website's privacy policy separately on 22
June 2020 but were visible as one of the 443 'direct clients' on 21 July
2020. The precise date on which Valca became visible is not known.
30. On 22 July 2020 the Commissioner served a third-party Information Notice ("3PIN") on - - to establish, inter alia, the number of connected messages sent by Valca between 1 June
2020 and 20 July 2020.
31. The response to the 3PIN advised that there had been 104,550 messages sent by Valca between 15 June 2020 and 20 July 2020, of
which 95,004 were delivered to a subscriber.
32. The 3PIN also provided details of the content for each of the messages sent, of which a trend could be identified that none of the messages
sent contained an opt-out link until 25 June 2020 - the first day
following the Commissioner's initial investigation letter. It can therefore be determined that between 15 June 2020 and 24 June 2020 there were 24,995 text messages sent without an opt-out link, of which 18,393 were delivered.
9
33. The Commissioner is aware, from information provided by Valca on 7
July 2020, of a further 2,025 text messages being sent by Valca over the period of contravention using the - platform, although this
platform was used for just one day, and the number of received
messages is unknown and is unlikely to be obtainable.
34. As of 20 July 2020, the Commissioner was able to identify a total of
114 complaints concerning Valca's unsolicited direct marketing text messages over the relevant period.
35. An 'end of investigation' letter was sent to Valca on 21 July 2020.
36. The Commissioner has since identified that between 21 July 2020 and
13 November 2020 there were a further 165 complaints made about
Valca via the 7726 service.
37. The Commissioner has made the above findings of fact on the
balance of probabilities.
38. The Commissioner has considered whether those facts constitute a contravention of regulations 22 and 23 of PECR by Valca and, if so,
whether the conditions of section SSA DPA are satisfied.
The contravention
39. The Commissioner finds that Valca contravened regulations 22 and 23 of PECR.
40. The Commissioner finds that the contravention was as follows:
41. The Commissioner finds that between 15 June 2020 and 20 July 2020
there were 95,004 unsolicited direct marketing text messages received
10
by subscribers. This resulted in a total of 114 complaints being
received via the 7726 service. The Commissioner finds that Valca
transmitted the direct marketing messages received, contrary to regulation 22 of PECR.
42. The Commissioner is satisfied that the contravention could have been
higher, with a total of 104,550 unsolicited text messages being sent
over the relevant time using the-platform, and a further 2,025
being sent using -·
43. Of the messages known to have been received, 18,393 (i.e., all of those received before 25 June 2020) did not contain an opt-out link,
contrary to the requirements of regulation 23 PECR.
44. Valca, as the sender of the direct marketing, is required to ensure that it is acting in compliance with the requirements of regulation 22 of
PECR, and to ensure that valid consent to send those messages had been acquired.
45. Valca relied on consent obtained by another organisation for its own
purposes, i.e., 'indirect consent'. The Commissioner's direct marketing
guidance says "organisations need to be aware that indirect consent
will not be enough for texts, emails or automated calls. This is because the rules on electronic marketing are stricter, to reflect the more
intrusive nature of electronic messages."
46. It goes on to say that indirect consent can be valid but only if it is clear
and specific enough. Moreover, "the customer must have anticipated
that their details would be passed to the organisation in question, and that they were consenting to messages from that organisation. This will
depend on what exactly they were told when consent was obtained".
1 1
47. Consent will not be "informed" if individuals do not understand what they are consenting to. Organisations should therefore always ensure
that the language used is clear, easy to understand, and not hidden
away in a privacy policy or small print. The Commissioner is concerned
that at the point of consent being obtained, subscribers are asked to tick a box which gives a misleading impression that only a limited
number of 16 organisations may contact them (duly named within the
'partners' link on the registration page). However, it is only if
subscribers drill down into the separate privacy policy that they are
advised that any one of 450 companies may in fact contact them, none
of which the subscriber has any ability to refuse contact from.
48. It is the Commissioner's position that consent will not be valid if
individuals are asked to agree to receive marketing from "similar
organisations", "partners", "selected third parties" or other similar
generic description. Further, and relevantly, consent will not be valid
where an individual is presented with a long, seemingly exhaustive list
of general categories of organisations. The Commissioner finds that
450 organisations, concerning 40 sectors, is far too exhaustive a list to
enable individuals to give valid consent.
49. During the course of the investigation, Valca provided an invoice dated 16 March 2020 between it and its third-party data provider to
demonstrate that it had paid to be added to the privacy policy for
, the website from which its third-party data provider
obtained data. The date on which Valca were added to the privacy
policy is unclear, however the Commissioner has evidence that it was not listed as a 'direct client', or apparently at all on
by 22 June 2020, by which point Valca had already sent 16,759 unsolicited text messages using data obtained from that site. In any
event, even after Valca had been added to the privacy policy, the
12
Commissioner has concerns that any consents relied on by Valca cannot be said to be valid.
50. There is nothing immediately in the consent statement at registration that would inform an individual that by agreeing to the privacy policy
and terms and conditions, they are in fact agreeing for their data to be passed to 450 companies spanning 40 various sectors. Whilst there is a
third-party consent opt-in box, this only lists 16 companies at the point
of consent and gives individuals no indication that for a more
comprehensive list they will need to consult the privacy policy. This
cannot constitute informed consent.
51. The Commissioner is therefore satisfied from the evidence she has
seen that Valca did not have the necessary valid consent to send the
95,004 unsolicited direct marketing messages received by subscribers. This constitutes a contravention of regulation 22 PECR.
52. The Commissioner is also concerned that 18,393 of those received messages (i.e., all of those received before the Commissioner's initial
investigation letter) did not contain an opt-out link. As such, the Commissioner is satisfied that the actions of Valca in respect of these 18,393 messages have also contravened regulation 23 PECR.
53. The Commissioner has gone on to consider whether the conditions
under section SSA DPA are met.
Seriousness of the contravention
54. The Commissioner is satisfied that the contravention identified
above was serious. This is because between 15 June 2020 and 20 July
2020 a total of 95,004 connected unsolicited direct marketing messages were received by subscribers, resulting in 114 complaints.
13
55. Valca has failed to provide any evidence of valid consent for any of the
95,004 unsolicited direct marketing messages received by subscribers.
56. In addition, the Commissioner is concerned by the content of the
unsolicited text messages which reference the Covid-19 pandemic and
appeal to individuals whose finances have been adversely affected.
This, in the Commissioner's view, is a clear attempt to capitalise on,
and profiteer from, the national health crisis.
57. The Commissioner is therefore satisfied that condition (a) from section 55A(l) DPA is met.
Deliberate or negligent contraventions
above was deliberate.
59. The Commissioner considers that Valca deliberately set out to contravene PECR in this instance. The data relied on by Valca was not
validly opted-in, and beyond paying a small sum for its inclusion on a
privacy policy there is no indication that they sought to undertake any additional steps to ensure protection of individuals' privacy rights, i.e.,
by observing the 'customer journey'; doing so would likely have raised
concerns with Valca regarding its reliance on the data being obtained.
It is also concerning that Valca continued to send its unsolicited direct
marketing text messages (albeit with an opt-out link) even following
the Commissioner's initial investigation correspondence which
highlighted real concerns with the organisation's compliance with PECR.
14
60. Further, and in any event, the Commissioner has gone on to consider
whether the contravention identified above was negligent. This
consideration comprises two elements:
61. Firstly, she has considered whether Valca knew or ought reasonably to
have known that there was a risk that these contraventions would occur. She is satisfied that this condition is met, not least since the
issue of unsolicited text messages have been widely publicised by the
media as being a problem.
62. The Commissioner has published detailed guidance for those carrying
out direct marketing explaining their legal obligations under PECR.
This guidance gives clear advice regarding the requirements of consent
for direct marketing and explains the circumstances under which organisations are able to carry out marketing over the phone, by text,
by email, by post, or by fax. In particular it states that organisations
can generally only send, or instigate, marketing messages to
individuals if that person has specifically consented to receiving them. The guidance is also clear about the significant risks of relying on
indirect consent, as Valca did in this instance.
63. The Commissioner also notes that the company's sole director, in a
self-written biography on f6s.com, describes himself as a 'serial
entrepreneur with vast experience in sales and marketing'.
64. It is therefore reasonable to suppose that Valca should have been aware of its responsibilities in this area.
65. Secondly, the Commissioner has gone on to consider whether Valca failed to take reasonable steps to prevent the contraventions. Again,
she is satisfied that this condition is met.
15
show that Valca were to be added to the privacy policy of on an unknown date (which was, in any event,
evidently not before 22 June 2020).
66. Valca used a bought-in list of data and relied on indirect consent for its
unsolicited direct marketing messages. It claimed during the
investigation that it had carried out "full due diligence", however the
Commissioner has seen little evidence of this in ensuring the veracity
of the data being purchased aside from the production of an invoice to
67. Whilst Valca advised in the course of the investigation that "due
diligence wise we run various checks on any Company that we consider using from the ICO MOJ and other governing bodies to ensure that
there are no outstanding concerns relating to them as a potential
supplier, we also look at financials, recommendations from other
Companies within this arena and finally check out any online listings for
any bad press" [sic], such checks do nothing to ensure that the data
being obtained by Valca is compliant for its own marketing purposes.
68. Such reasonable steps which the Commissioner might expect in these
circumstances could have included ensuring a comprehensive contract was in place with the third-party data provider for the provision of the
data to be relied upon, to ensure its reliability and validity. It would
also have been reasonable for Valca to carry out its own checks as to
how consent was being obtained via the site,
notwithstanding any assurances by its third-party data provider - such checks would have alerted Valca to the inadequacy of the consents
being obtained via this site for the purposes of third-party direct marketing. In short, simple reliance on assurances of indirect consent
alone without undertaking proper due diligence is not acceptable.
69. In the circumstances, the Commissioner is satisfied that Valca failed to
take reasonable steps to prevent the contraventions.
16
70. The Commissioner is therefore satisfied that condition (b) from section
SSA (1) DPA is met.
The Commissioner's decision to issue a monetary penalty
71. The Commissioner has also taken into account the following
aggravating features of this case:
• Valca failed to include an opt-out in its unsolicited direct marketing
messages up until the Commissioner's initial investigation letter, in
direct contravention of regulation 23 PECR;
• Thereafter, despite being under investigation by the Commissioner
where concerns were raised regarding its PECR compliance, and where
it was notified that a number of complaints had already been received,
Valca continued to send unsolicited messages to its data set during the
period of contravention;
72. For the reasons explained above, the Commissioner is satisfied that the
conditions from section SSA (1) DPA have been met in this case. She is also satisfied that the procedural rights under section SSB have been
complied with.
73. The latter has included the issuing of a Notice of Intent, in which the Commissioner set out her preliminary thinking. In reaching her final
view, the Commissioner has taken into account the representations
made by Valca on this matter.
74. The Commissioner is accordingly entitled to issue a monetary penalty
in this case.
75. The Commissioner has considered whether, in the circumstances, she
should exercise her discretion so as to issue a monetary penalty.
76. The Commissioner has considered the financial representations made,
and the likely impact of a monetary penalty on Valca. She has decided on the information that is available to her, that a monetary penalty in
the figure proposed remains an appropriate and proportionate response to the contravention.
77. The Commissioner's underlying objective in imposing a monetary
penalty notice is to promote compliance with PECR. The sending of
unsolicited marketing text messages is a matter of significant public
concern. A monetary penalty in this case should act as a general
encouragement towards compliance with the law, or at least as a deterrent against non-compliance, on the part of all persons running
businesses currently engaging in these practices. The issuing of a
monetary penalty will reinforce the need for businesses to ensure that they are only messaging those who specifically consent to receive
marketing.
78. For these reasons, the Commissioner has decided to issue a monetary
penalty in this case.
The amount of the penalty
79. Taking into account all of the above, the Commissioner has decided
that a penalty in the sum of £80,000 (eighty thousand pounds) is
reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty.
18
Conclusion
80. The monetary penalty must be paid to the Commissioner's office by
BACS transfer or cheque by 23 March 2021 at the latest. The
monetary penalty is not kept by the Commissioner but will be paid into
the Consolidated Fund which is the Government's general bank account at the Bank of England.
81. If the Commissioner receives full payment of the monetary penalty by
22 March 2021 the Commissioner will reduce the monetary penalty by 20% to £64,000 (sixty-four thousand pounds). However, you
should be aware that the early payment discount is not available if you
decide to exercise your right of appeal.
82. There is a right of appeal to the First-tier Tribunal (Information Rights)
against:
(a) the imposition of the monetary penalty
and/or; (b) the amount of the penalty specified in the monetary penalty
notice.
83. Any notice of appeal should be received by the Tribunal within 28 days
of the date of this monetary penalty notice.
84. Information about appeals is set out in Annex 1.
85. The Commissioner will not take action to enforce a monetary penalty
unless:
19
• the period specified within the notice within which a monetary penalty must be paid has expired and all or any of the monetary
penalty has not been paid;
• all relevant appeals against the monetary penalty notice and any
variation of it have either been decided or withdrawn; and
• the period for appealing against the monetary penalty and any
variation of it has expired.
86. In England, Wales and Northern Ireland, the monetary penalty is
recoverable by Order of the County Court or the High Court. In
Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution
issued by the sheriff court of any sheriffdom in Scotland.
Dated the 18th day of February 2021
Andy Curry Head of Investigations Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 SAF
20
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER
1. Section 55B(S) of the Data Protection Act 1998 gives any person
upon whom a monetary penalty notice has been served a right of appeal to the First-tier Tribunal (Information Rights) (the 'Tribunal')
against the notice.
2. If you decide to appeal and if the Tribunal considers: -
a) that the notice against which the appeal is brought is not in accordance with the law; or
b) to the extent that the notice involved an exercise of
discretion by the Commissioner, that she ought to have exercised her discretion differently,
the Tribunal will allow the appeal or substitute such other decision as could have been made by the Commissioner. In any other case the
Tribunal will dismiss the appeal.
3. You may bring an appeal by serving a notice of appeal on the
Tribunal at the following address:
General Regulatory Chamber HM Courts & Tribunals Service
PO Box 9300 Leicester
Email: [email protected]
a) The notice of appeal should be sent so it is received by the
Tribunal within 28 days of the date of the notice.
b) If your notice of appeal is late the Tribunal will not admit it
unless the Tribunal has extended the time for complying with this
rule.
a) your name and address/name and address of your
representative (if any);
b) an address where documents may be sent or delivered to
you;
d) details of the decision to which the proceedings relate;
e) the result that you are seeking;
f) the grounds on which you rely;
g) you must provide with the notice of appeal a copy of the
monetary penalty notice or variation notice;
22
h) if you have exceeded the time limit mentioned above the notice of appeal must include a request for an extension of time
and the reason why the notice of appeal was not provided in time.
5. Before deciding whether or not to appeal you may wish to consult
your solicitor or another adviser. At the hearing of an appeal a party
may conduct his case himself or may be represented by any person
whom he may appoint for that purpose.
6. The statutory provisions concerning appeals to the First-tier
Tribunal (Information Rights) are contained in section 55B(S) of, and Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 1976 (L.20)).
23
MONETARY PENAL TY NOTICE
1.
1.
1.
The Information Commissioner ("Commissioner") has decided to issue Valca Vehicle and Life Cover Agency Limited ("Valca") with a monetary penalty under section SSA of the Data Protection Act 1998 ("DPA"). The penalty is in relation to a serious contravention of Regulations 22 and 23 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR").
2.
2.
Legal framework
Legal framework
Legal framework
3.
3.
3.
Valca, whose registered office is given above (Companies House Registration Number: 11013461) is the organisation stated in this notice to have transmitted unsolicited communications by means of electronic mail to individual subscribers for the purposes of direct marketing contrary to regulation 22 of PECR.
4.
4.
"(l) This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers.
(2)
(2)
(2)
Except in the circumstances referred to in paragraph (3), a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender.
(3)
(3)
(3)
-
(a)
(a)
(a)
that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient;
(b)
(b)
the direct marketing is in respect of that person's similar products and services only; and
( c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication.
( 4) A subscriber shall not permit his line to be used in contravention of paragraph (2)."
-
(a)
(a)
(a)
where the identity of the person on whose behalf the communication has been sent has been disguised or concealed;
(b)
(b)
where a valid address to which the recipient of the communication may send a request that such communications cease has not been provided
(c)
(c)
where that electronic mail would contravene regulation 7 of the Electronic Commerce (EC Directive) Regulations 2002; or
(d)
(d)
where that electronic mail encourages recipients to visit websites which contravene that regulation."
6.
6.
6.
Section 122(5) of the DPA 2018 defines direct marketing as "the communication (by whatever means) of advertising material which is directed to particular individuals". This definition also applies for the purposes of PECR (see regulation 2(2) PECR; and Schedule 19, paragraph 430 and 432(6) DPA18).
7.
7.
Consent is defined in Article 4(11) the General Data Protection Regulation 2016/679 as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
8.
8.
"Individual" is defined in regulation 2(1) of PECR as "a living individual and includes an unincorporated body of such individuals".
9.
9.
9.
A "subscriber" is defined in regulation 2(1) of PECR as "a person who is a party to a contract with a provider of public electronic communications services for the supply of such services".
10.
10.
"Electronic mail" is defined in regulation 2(1) of PECR as "any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient and includes messages sent using a short message service".
11.
11.
Section SSA of the DPA (as amended by the Privacy and Electronic Communications (EC Directive)(Amendment) Regulations 2011 and the Privacy and Electronic Communications (Amendment) Regulations 2015) states:
-
(a)
(a)
(a)
there has been a serious contravention of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 by the person,
(b)
(b)
(2)
(2)
(2)
(3)
(3)
(3)
-
(a)
(a)
(a)
knew or ought to have known that there was a risk that the contravention would occur, but
(b)
(b)
12.
12.
12.
The Commissioner has issued statutory guidance under section SSC (1) of the DPA about the issuing of monetary penalties that has been published on the ICO's website. The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe that the amount of any penalty determined by the Commissioner must not exceed £500,000.
13.
13.
PECR implements European legislation (Directive 2002/58/EC) aimed at the protection of the individual's fundamental right to privacy in the electronic communications sector. PECR was amended for the purpose of giving effect to Directive 2009/136/EC which amended and strengthened the 2002 provisions. The Commissioner approaches PECR so as to give effect to the Directives.
14.
14.
The provisions of the DPA remain in force for the purposes of PECR notwithstanding the introduction of the Data Protection Act 2018 (see paragraph 58(1) of Part 9, Schedule 20 of that Act).
15.
15.
15.
Phone users can report the receipt of unsolicited marketing text messages to the GSMA's Spam Reporting Service by forwarding the message to 7726 (spelling out "SPAM"). The GSMA is an organisation that represents the interests of mobile operators worldwide. The Commissioner is provided with access to the data on complaints made to the 7726 service and this data is incorporated into a Monthly Threat Assessment (MTA) used to ascertain organisations in breach of PECR.
16.
16.
Valca are a company specialising in lead generation for financial products. They currently operate as 'Debtquity' to generate leads for
products.
17. Val ca came to the attention of the Commissioner after an initial 22 complaints were received via the 7726 complaints tool about unsolicited text messages between 15 June 2020 and 23 June 2020. These text messages contained, or contained slight variations of, the following text:
"*firstname* Affected by Covid? Struggling with finances? lost job
/furloughed? Were here to help! Gvnmnt backed support see if you
18.
18.
18.
It was noted that these texts did not offer individuals an ability to 'optout' of future unsolicited text messages.
19.
19.
An initial investigation letter was sent to Valca on 24 June 2020, highlighting the Commissioner's concerns with Valca's PECR compliance and requesting information relating to the volumes of texts sent, the source of data used to send said texts, details of any due diligence undertaken, together with questions regarding the lack of an opt-out in the text messages for which there had been complaints. An appendix detailing the complaints received was also sent to Valca.
20. The director of Valca provided a partial response on 24 June 2020 stating that "all data we use is fully compliant and purchased from credible UK data suppliers that we carried out full due diligence against prior to point of supply, in relation to not listing an opt out on said SMS messages this is down to human error and has been amended now for future broadcasts, we are happy to send out an opt out message to the complaints made to date which is a total of 23 from a one of broadcast of 30. 000 lines
ICO. Information Commissioner's Office the bud
campaign on the 15June 2020 so we have nipped this inextremely early" [sic].
th
21. The Commissioner, on 25 June 2020, advised Valca not to contact the complainants again, but to add them to a suppression list, and asked that Valca respond to all of the initial questions asked by the Commissioner in full.
22. A further substantive response was provided by Valca on 7 July 2020. This response advised that two platforms were used to send Valca's direct marketing messages: _, and_, with reports being provided to show the volumes of messages sent via those platforms.
23. Valca confirmed that its data was purchased from a third party: •
Lim
ited (the "third-party data provider"), and that regarding its due diligence with the third-party data provider, it "matched our campaign and Company requirements against fully opted in data, due diligence wise we run various checks on any Company that we consider using from the ICO MOJ and other governing bodies to ensure that there are no outstanding concerns relating to them as a potential supplier, we also look at financials, recommendations from other Companies within this arena and finally check out a
L
LI
Form
24.
In terms of evidencing how consent is obtained by the third-party data provider for Valca to engage in direct marketing, Valca advised that it is "on privacy policy and other privacy policies allow for third party marketing also" [sic].
25.
25.
The Commissioner directed further enquiries to Valca on 8 July 2020, requesting information as to the data purchased, and the agreement with the third-party data provider. An updated complaints spreadsheet
was provided to Valca, showing that there had now been a total of 68 complaints recognised in relation to its text messages.
'
. Valca produced updated 'outbound SMS' reports for its-and -platforms, although it noted that_ had been used for just one day. Valca also produced a document as purported evidence of consent for the initial 22 complaints, with each
Form
of the 22 complainant's data having been obtained through
27. requires users to register with it to use its services and operates by offering 'deals'. At the point of registration, users agree to a consent statement where they are able to select whether they wish to be contacted by email, SMS, post, and/or telephone, together with a further option to agree to being contacted by 'the following partners' using the agreed methods. The 'Partners' link takes users to a 'brands page' which lists 16 distinct companies, none of which are Valca. There appears to be no opti
28. Upon viewing Privacy Policy, users are told: "Once you register with the our website you consent to its sponsor question clients and website sponsors being able to send you communications via the channel(s) you selected as part of the sign
Form
Form
and its
up until such time as you exercise your right to opt-out of receiving such communications"
29.
29.
29.
The Privacy Policy proceeds to provide two further lists of companies: a 'marketing service providers' list containing 7 distinct companies, and a list of 'direct clients' containing 443 distinct companies. The Privacy Policy's 'Data Collection Notice' advises thatpartners operate in over 40 areas, spanning a wide range of sectors including fashion, automotive, gambling, construction, legal services etc. The Commissioner noted that Valca were not visible at all as of checks carried out on the website's priv
30.
30.
On 22 July 2020 the Commissioner served a third-party Information
Notice ("3PIN") on --to establish, inter
alia, the number of connected messages sent by Valca between 1 June 2020 and 20 July 2020.
31.
31.
31.
The response to the 3PIN advised that there had been 104,550 messages sent by Valca between 15 June 2020 and 20 July 2020, of which 95,004 were delivered to a subscriber.
32.
32.
The 3PIN also provided details of the content for each of the messages sent, of which a trend could be identified that none of the messages sent contained an opt-out link until 25 June 2020 -the first day following the Commissioner's initial investigation letter. It can therefore be determined that between 15 June 2020 and 24 June 2020 there were 24,995 text messages sent without an opt-out link, of which 18,393 were delivered.
33. The Commissioner is aware, from information provided by Valca on 7 July 2020, of a further 2,025 text messages being sent by Valca over the period of contravention using the -platform, although this platform was used for just one day, and the number of received messages is unknown and is unlikely to be obtainable.
34.
34.
34.
As of 20 July 2020, the Commissioner was able to identify a total of 114 complaints concerning Valca's unsolicited direct marketing text messages over the relevant period.
35.
35.
An 'end of investigation' letter was sent to Valca on 21 July 2020.
36.
36.
The Commissioner has since identified that between 21 July 2020 and 13 November 2020 there were a further 165 complaints made about Valca via the 7726 service.
37.
37.
The Commissioner has made the above findings of fact on the balance of probabilities.
38. The Commissioner has considered whether those facts constitute a contravention of regulations 22 and 23 of PECR by Valca and, if so, whether the conditions of section SSA DPA are satisfied.
The contravention
The contravention
The contravention
39.
39.
39.
The Commissioner finds that Valca contravened regulations 22 and 23 of PECR.
40.
40.
41.
41.
The Commissioner finds that between 15 June 2020 and 20 July 2020 there were 95,004 unsolicited direct marketing text messages received
by subscribers. This resulted in a total of 114 complaints being received via the 7726 service. The Commissioner finds that Valca transmitted the direct marketing messages received, contrary to regulation 22 of PECR.
42.
42.
42.
The Commissioner is satisfied that the contravention could have been higher, with a total of 104,550 unsolicited text messages being sent over the relevant time using the-platform, and a further 2,025 being sent using -·
43.
43.
Of the messages known to have been received, 18,393 (i.e., all of those received before 25 June 2020) did not contain an opt-out link, contrary to the requirements of regulation 23 PECR.
44.
44.
Valca, as the sender of the direct marketing, is required to ensure that it is acting in compliance with the requirements of regulation 22 of PECR, and to ensure that valid consent to send those messages had been acquired.
45.
45.
Valca relied on consent obtained by another organisation for its own purposes, i.e., 'indirect consent'. The Commissioner's direct marketing guidance says "organisations need to be aware that indirect consent will not be enough for texts, emails or automated calls. This is because the rules on electronic marketing are stricter, to reflect the more intrusive nature of electronic messages."
46.
46.
It goes on to say that indirect consent can be valid but only if it is clear and specific enough. Moreover, "the customer must have anticipated that their details would be passed to the organisation in question, and that they were consenting to messages from that organisation. This will depend on what exactly they were told when consent was obtained".
47.
47.
47.
Consent will not be "informed" if individuals do not understand what they are consenting to. Organisations should therefore always ensure that the language used is clear, easy to understand, and not hidden away in a privacy policy or small print. The Commissioner is concerned that at the point of consent being obtained, subscribers are asked to tick a box which gives a misleading impression that only a limited number of 16 organisations may contact them (duly named within the 'partners' link on the registra
48.
48.
It is the Commissioner's position that consent will not be valid if individuals are asked to agree to receive marketing from "similar organisations", "partners", "selected third parties" or other similar generic description. Further, and relevantly, consent will not be valid where an individual is presented with a long, seemingly exhaustive list of general categories of organisations. The Commissioner finds that 450 organisations, concerning 40 sectors, is far too exhaustive a list to enable individuals to
49.
49.
,
the website from which its third-party data provider obtained data. The date on which Valca were added to the privacy policy is unclear, however the Commissioner has evidence that it was not listed as a 'direct client', or apparently at all on
by 22 June 2020, by which point Valca had already sent 16,759 unsolicited text messages using data obtained from that site. In any
event, even after Valca had been added to the privacy policy, the
Commissioner has concerns that any consents relied on by Valca
cannot be said to be valid.
50.
50.
50.
There is nothing immediately in the consent statement at registration that would inform an individual that by agreeing to the privacy policy and terms and conditions, they are in fact agreeing for their data to be passed to 450 companies spanning 40 various sectors. Whilst there is a third-party consent opt-in box, this only lists 16 companies at the point of consent and gives individuals no indication that for a more comprehensive list they will need to consult the privacy policy. This cannot constitute in
51.
51.
The Commissioner is therefore satisfied from the evidence she has seen that Valca did not have the necessary valid consent to send the 95,004 unsolicited direct marketing messages received by subscribers. This constitutes a contravention of regulation 22 PECR.
52.
52.
The Commissioner is also concerned that 18,393 of those received messages (i.e., all of those received before the Commissioner's initial investigation letter) did not contain an opt-out link. As such, the Commissioner is satisfied that the actions of Valca in respect of these 18,393 messages have also contravened regulation 23 PECR.
53.
53.
The Commissioner has gone on to consider whether the conditions under section SSA DPA are met.
54. The Commissioner is satisfied that the contravention identified above was serious. This is because between 15 June 2020 and 20 July 2020 a total of 95,004 connected unsolicited direct marketing messages were received by subscribers, resulting in 114 complaints.
55.
55.
55.
Valca has failed to provide any evidence of valid consent for any of the 95,004 unsolicited direct marketing messages received by subscribers.
56.
56.
In addition, the Commissioner is concerned by the content of the unsolicited text messages which reference the Covid-19 pandemic and appeal to individuals whose finances have been adversely affected. This, in the Commissioner's view, is a clear attempt to capitalise on, and profiteer from, the national health crisis.
57.
57.
The Commissioner is therefore satisfied that condition (a) from section 55A(l) DPA is met.
The Commissioner has considered whether the contravention identified above was deliberate.
59.
59.
The Commissioner considers that Valca deliberately set out to contravene PECR in this instance. The data relied on by Valca was not validly opted-in, and beyond paying a small sum for its inclusion on a privacy policy there is no indication that they sought to undertake any additional steps to ensure protection of individuals' privacy rights, i.e., by observing the 'customer journey'; doing so would likely have raised concerns with Valca regarding its reliance on the data being obtained. It is also concerni
60.
60.
60.
Further, and in any event, the Commissioner has gone on to consider whether the contravention identified above was negligent. This consideration comprises two elements:
61.
61.
Firstly, she has considered whether Valca knew or ought reasonably to have known that there was a risk that these contraventions would occur. She is satisfied that this condition is met, not least since the issue of unsolicited text messages have been widely publicised by the media as being a problem.
62.
62.
The Commissioner has published detailed guidance for those carrying out direct marketing explaining their legal obligations under PECR. This guidance gives clear advice regarding the requirements of consent for direct marketing and explains the circumstances under which organisations are able to carry out marketing over the phone, by text, by email, by post, or by fax. In particular it states that organisations can generally only send, or instigate, marketing messages to individuals if that person has speci
63.
63.
The Commissioner also notes that the company's sole director, in a self-written biography on f6s.com, describes himself as a 'serial entrepreneur with vast experience in sales and marketing'.
64.
64.
It is therefore reasonable to suppose that Valca should have been aware of its responsibilities in this area.
65.
65.
Secondly, the Commissioner has gone on to consider whether Valca failed to take reasonable steps to prevent the contraventions. Again, she is satisfied that this condition is met.
Form
show that Valca were to be added to the privacy policy of on an unknown date (which was, in any event, evidently not before 22 June 2020).
66. Valca used a bought-in list of data and relied on indirect consent for its unsolicited direct marketing messages. It claimed during the investigation that it had carried out "full due diligence", however the Commissioner has seen little evidence of this in ensuring the veracity of the data being purchased aside from the production of an invoice to
67.
67.
67.
Whilst Valca advised in the course of the investigation that "due diligence wise we run various checks on any Company that we consider using from the ICO MOJ and other governing bodies to ensure that there are no outstanding concerns relating to them as a potential supplier, we also look at financials, recommendations from other Companies within this arena and finally check out any online listings for any bad press" [sic], such checks do nothing to ensure that the data being obtained by Valca is compliant f
68.
68.
Such reasonable steps which the Commissioner might expect in these circumstances could have included ensuring a comprehensive contract was in place with the third-party data provider for the provision of the data to be relied upon, to ensure its reliability and validity. It would also have been reasonable for Valca to carry out its own checks as to how consent was being obtained via the site, notwithstanding any assurances by its third-party data provider -such checks would have alerted Valca to the inadequ
69.
69.
In the circumstances, the Commissioner is satisfied that Valca failed to take reasonable steps to prevent the contraventions.
70. The Commissioner is therefore satisfied that condition (b) from section SSA (1) DPA is met.
•
•
•
•
•
Thereafter, despite being under investigation by the Commissioner where concerns were raised regarding its PECR compliance, and where it was notified that a number of complaints had already been received, Valca continued to send unsolicited messages to its data set during the period of contravention;
72.
72.
72.
For the reasons explained above, the Commissioner is satisfied that the conditions from section SSA (1) DPA have been met in this case. She is also satisfied that the procedural rights under section SSB have been complied with.
73.
73.
The latter has included the issuing of a Notice of Intent, in which the Commissioner set out her preliminary thinking. In reaching her final view, the Commissioner has taken into account the representations made by Valca on this matter.
74.
74.
The Commissioner is accordingly entitled to issue a monetary penalty in this case.
The Commissioner has considered whether, in the circumstances, she should exercise her discretion so as to issue a monetary penalty.
76.
76.
The Commissioner has considered the financial representations made, and the likely impact of a monetary penalty on Valca. She has decided on the information that is available to her, that a monetary penalty in the figure proposed remains an appropriate and proportionate response to the contravention.
77.
77.
The Commissioner's underlying objective in imposing a monetary penalty notice is to promote compliance with PECR. The sending of unsolicited marketing text messages is a matter of significant public concern. A monetary penalty in this case should act as a general encouragement towards compliance with the law, or at least as a deterrent against non-compliance, on the part of all persons running businesses currently engaging in these practices. The issuing of a monetary penalty will reinforce the need for bus
78.
78.
For these reasons, the Commissioner has decided to issue a monetary penalty in this case.
79. Taking into account all of the above, the Commissioner has decided that a penalty in the sum of £80,000 (eighty thousand pounds) is reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty.
Conclusion
Conclusion
Conclusion
80.
80.
80.
The monetary penalty must be paid to the Commissioner's office by BACS transfer or cheque by 23 March 2021 at the latest. The monetary penalty is not kept by the Commissioner but will be paid into the Consolidated Fund which is the Government's general bank account at the Bank of England.
81.
81.
If the Commissioner receives full payment of the monetary penalty by 22 March 2021 the Commissioner will reduce the monetary penalty by 20% to £64,000 (sixty-four thousand pounds). However, you should be aware that the early payment discount is not available if you decide to exercise your right of appeal.
82.
82.
82.
There is a right of appeal to the First-tier Tribunal (Information Rights) against:
(a)
(a)
(a)
(b)
(b)
the amount of the penalty specified in the monetary penalty notice.
83.
83.
Any notice of appeal should be received by the Tribunal within 28 days of the date of this monetary penalty notice.
84.
84.
85.
85.
The Commissioner will not take action to enforce a monetary penalty unless:
•
•
•
•
•
•
•
the period for appealing against the monetary penalty and any variation of it has expired.
86. In England, Wales and Northern Ireland, the monetary penalty is recoverable by Order of the County Court or the High Court. In Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution
issued by the sheriff court of any sheriffdom in Scotland.
Dated the 18day of February 2021
th
Water Lane
Wilmslow Cheshire
SK9 SAF
1. Section 55B(S) of the Data Protection Act 1998 gives any person
upon whom a monetary penalty notice has been served a right of appeal to the First-tier Tribunal (Information Rights) (the 'Tribunal') against the notice.
-
a)
a)
a)
that the notice against which the appeal is brought is not in accordance with the law; or
b)
b)
to the extent that the notice involved an exercise of discretion by the Commissioner, that she ought to have exercised her discretion differently,
the Tribunal will allow the appeal or substitute such other decision as could have been made by the Commissioner. In any other case the Tribunal will dismiss the appeal.
3. You may bring an appeal by serving a notice of appeal on the Tribunal at the following address:
General Regulatory Chamber
a)
a)
a)
a)
The notice of appeal should be sent so it is received by the
Tribunal within 28 days of the date of the notice.
b)
b)
If your notice of appeal is late the Tribunal will not admit it
unless the Tribunal has extended the time for complying with this rule.
4. The notice of appeal should state:
-
representative (if any);
b) an address where documents may be sent or delivered to
you;
c)
c)
c)
d)
d)
e)
e)
f)
f)
g)
g)
you must provide with the notice of appeal a copy of the monetary penalty notice or variation notice;
h) if you have exceeded the time limit mentioned above the notice of appeal must include a request for an extension of time and the reason why the notice of appeal was not provided in time.
5.
5.
5.
Before deciding whether or not to appeal you may wish to consult your solicitor or another adviser. At the hearing of an appeal a party may conduct his case himself or may be represented by any person whom he may appoint for that purpose.
6.
6.

valca vehicle & life cover agency ltd - mpn

Documents